Trojan Spyware Through TW Website?

[Kristaps]

Just wondered if you guys have had a similar experience with the pop-ups from this website: it seems they install Trojan adware on your computer... Today, I had Lycos Side Search, Alexa, Power Scan and Tyme Sync install themselves all at the same time while I was browsing forums (my virus scan confirmed the install time).

[nick_maxell]

I didn t get anything installed but my firewall blocked some weird hits while I am here (eg from vis.sexlist.com : 5/23/2004 4:39:47 PM vis.sexlist.com Record deleted 207.246.138.125, 207.246.138.126, 207.246.138.137, 207.246.138.139, 207.246.138.140, 207.246.138.150)

also got hits from other sites so it seems there is something wrong but could also be unrelated to the site and you got a trojan running already installing all that crap - do a free mcaffee online scan - its pretty good and finds most.



nick

[Colovion]

GO download Ad Aware and/or Spybot: Search and Destroy - you have spyware on your computer most likely as I don't have anything popping up.

[mfberg]

Block the popups, trying to close them (other than through the command line is dangerous. Block active-x

mfberg

[Gregoshi]

A few others have mentioned this too. IIRC, Tosa was going to inquire with the host regarding the issue. He can speak to the issue better than I can.

[octavian]

also check out the many toolbars around, most if not all block pop-ups as a secondary function.

[solypsist]

This is a Watchtower thread, and it happens there is already a topic on this same matter in there.
Our data shows it's not an Org thing, but probably a localized event. Users from the UK tend to get these things more often than others, etc.
If you wish to comment on this, please use the Watchtower topic.

[TosaInu]

Hello,

There was a UK localized pop-up lately, which forced people to install software or crashed their computer. Not sure whether this was malware or 'just' a badly configured script. The problem is forwarded to UGO who is in charge of these advertizements. The server host was not amused.

That one was about Ringtones.

There are two possibilities:
-or it's a local problem and you need something like Ad Aware.
-there's yet another bad pop-up.

If it's the former, the Apothecary is a good place to get more help if required. If the latter, I like to hear that as it will be forwarded to the host. You can either post here or e-mail me. Please mention the country you are from (localized pop-ups) a description of the problem and the name of the advertisment, a screenshot perhaps?

[ElmarkOFear]

I have recently been hit by a series of spyware and popups on my PC. I noticed something odd, about the time everyone here started to complain about this problem. I got a telefragged site to when trying to go from one page of a post to another.

Whatever I have, was able to get past my router firewall, my Norton's anti-virus, my popup blocker, and is resisting all attempts to eliminate them with Ad-Aware and Spy Bot programs. I even searched throughout my entire registry and deleted anything which was not known to be attached to one of my programs, and still am not rid of this. Whatever it is keeps placing these programs, spyware, and popups on my PC. I am afraid, I will have to reformat to get rid of whatever it is.

[Teutonic Knight]

Get Google toolbar, it'll do all the pop-up blocking you need

[octavian]

nonetheless, toolbars are still a bandaid solution to the main problem....that being that there is something on your computer.

[Teutonic Knight]

oh... you've got adware... well just get Ad-Aware, superior to everything else but I'd also recommend getting Spybot S&D, sometimes it catches stuff that Ad-Aware doesn't...

[Tricky Lady]

Quote[/b] (TosaInu @ May 24 2004,20:52)]There are two possibilities:
-or it's a local problem and you need something like Ad Aware.
-there's yet another bad pop-up.

Hi,
I have AdAware, Spybot S&D and Hijackthis on my PC, and ran these programs several times the last few days.
None of the three found spyware or malware or anything malicious (except a few cookies, that I deleted afterwards).
And I still get linked to the Telefragged website, or to an obscure MP3 site.

[Teutonic Knight]

OT: nice avatar, Tricky Lady

[ElmarkOFear]

Yes I have Ad-Aware and Spybot and Norton's Anti-Virus. They do not catch this program that keeps loading up popups and other spyware, malware programs on my PC. It's frustrating, but I think a nice reformat will cure everything. :)

[nick_maxell]

Quote[/b] (ElmarkOFear @ May 26 2004,19:05)]Yes I have Ad-Aware and Spybot and Norton's Anti-Virus. They do not catch this program that keeps loading up popups and other spyware, malware programs on my PC. It's frustrating, but I think a nice reformat will cure everything. :)

Elmark,

that sounds more like a trojan than mal/ad ware - update your norton or use mcaffee online scan or the fsecure service (don t know if that one is free) before you reformat.
Also be aware that some free antipopup/spyware tools are actually popup/spyware and they can hide so you won t find them in registry (or running tasks) - the norton and mcaffee sites have some info how to remove them.

hope that helps



nick

PS: get a firewall with a setting disallowing installs or getting a prompt if attemted - that works well for me.

[Tricky Lady]

Quote[/b] (TosaInu @ May 24 2004,20:52)]There are two possibilities:
-or it's a local problem and you need something like Ad Aware.
-there's yet another bad pop-up.

I noticed that the link that work are also completely different:

this is one of ROCKHAMMER's links that doesn't work:
http://www.totalwar.org/cgi-bin/forum/www.samurai-archives.com

And this is one of the other links from the same page that works fine from my computer:
http://www.totalrome.com/ancientarchives/

I think there's a clear difference in structure... I don't know why the first one is so different, but it certainly causes trouble...
Doesn't anyone else experience this problem?

ciao

[TosaInu]

Hello Tricky Lady,

http://www.totalrome.com/ancientarchives/ points to an existing page

http://www.totalwar.org/cgi-bin/foru...i-archives.com points to a non existing page on the totalwar.org server (both http://www.totatwar.org and http://www.samurai-archives.com are working links, but not when mixed together).

Normally you'ld find a standard Not found page, but some servers are configured to display a special error page. Some webmasters bring the visitors back to the homepage whenever a mistake occurs (wrong page, broken script). Telefragged, the host, has done something similar, whenever a non existing page is requested on any of their servers the Telefragged home page is displayed. That one can trigger pop-ups. Those pop-ups are advertizements to bring in money, which is used to pay for the required hardware and bandwidth.

[Tricky Lady]

Quote[/b] (TosaInu @ May 29 2004,12:04)]Normally you'ld find a standard Not found page, but some servers are configured to display a special error page. Some webmasters bring the visitors back to the homepage whenever a mistake occurs (wrong page, broken script). Telefragged, the host, has done something similar, whenever a non existing page is requested on any of their servers the Telefragged home page is displayed. That one can trigger pop-ups. Those pop-ups are advertizements to bring in money, which is used to pay for the required hardware and bandwidth.

Ah, OK, so it's nothing spyware/malware related then? Good to know.
Thanks